Uber: [manage.jumpbikes.com] Blind XSS on Jump admin panel via user name

By setting a user's name to an XSS payload, a user was able to inject JavaScript which was executed on the administrative panel for Jump bikes, allowing complete compromise of the panel, exposing user activity, personal information and billing information...

Debian DSA-4331-1 : curl - security update

Two vulnerabilities were discovered in cURL, an URL transfer library. - CVE-2018-16839 Harry Sintonen discovered that, on systems with a 32 bit sizet, an integer overflow would be triggered when a SASL user name longer than 2GB is used. This would in turn cause a very small buffer to be allocated...

zzcms SQL Injection Vulnerability (CNVD-2018-26021)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the zs/subzs.php file in ZZCMS version 8.3. A remote attacker can exploit this vulnerability to obtain the current user name of mysql with the help of zzcmscpid cookie...

CVE-2018-18545

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

Microsoft Office: Disable user name and password

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officedisableusernamepasswd.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Disable user name and password Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This progr...

Code injection

DISPUTED The PhonePe wallet aka com.PhonePe.app application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by intercepting the user name and PIN during the initial configuration of the application. NOTE: the vendor says that, to exploit this, the user h...

CVE-2018-16432

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

CVE-2018-16313

Bludit 2.3.4 allows XSS via a user name...

Cross site scripting

Bludit 2.3.4 allows XSS via a user name...

CVE-2018-16313

Bludit 2.3.4 allows XSS via a user name...

CVE-2018-16313

Bludit 2.3.4 allows XSS via a user name...

CVE-2018-16313

CVE-2018-16313 affects Bludit 2.3.4 and enables cross-site scripting via a user name. The connected CNVD entry notes a remote XSS vulnerability in Bludit 2.3.4 that allows execution of JavaScript in the affected user’s browser, implying exploitation would occur through crafted user-name input. No...

PT-2018-13482

Name of the Vulnerable Software and Affected Versions Bludit version 2.3.4 Description The issue allows for cross-site scripting XSS attacks via a user name. Recommendations For Bludit version 2.3.4, update to a version that contains a fix for this issue...

Path traversal

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird 52.5.2...

CVE-2017-7847

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird 52.5.2...

SUSE-SU-2018:1652-1 Security update for slurm

This update for slurm to version 17.02.11 fixes the following issues: This security issue was fixed: - CVE-2018-10995: Ensure proper handling of user names aka username fields and group ids aka gid fields bsc1095508. This non-security issue was fixed: - Move config files to slurm-config package t...

Microsoft Windows: Network access: Allow anonymous SID/Name translation

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnaanonymoustranslation.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Network access: Allow anonymous SID/Name translation Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows: Do not display last user name

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winildisplaylastuser.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Interactive logon: Do not display last user name Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

PT-2018-10233

Name of the Vulnerable Software and Affected Versions SchedMD Slurm versions prior to 17.02.11 SchedMD Slurm versions 17.1x.x prior to 17.11.7 Description The issue concerns the mishandling of user name fields and gid fields, which could potentially lead to security issues. Recommendations For...

TP-Link EAP Controller and Omada Controller Cross-Site Scripting Vulnerability (CNVD-2018-09302)

TP-Link EAP Controller and Omada Controller are both software from China P&L TP-LINK for remote control of wireless AP access point devices. A cross-site scripting vulnerability exists in TP-Link EAP Controller and Omada Controller versions 2.5.4Windows and 2.6.0Windows. A remote attacker can...